vmware horizon hackers are under exploit

The post VMware Products Security Vulnerability Alert appeared first on InfoTech News. We recommend that users install the latest patches in a timely manner to avoid being hacked.

VMware Remote Console for Mac (VMRC for Mac).

VMware Workstation Pro / Player (Workstation).

CVE-2020-3959 Memory leak vulnerability in VMCI moduleĪ malicious actor with local non-administrative access to a virtual machine may be able to crash the virtual machine’s vmx process leading to a partial denial of service.Successful exploitation of this issue may allow attackers with non-administrative access to a virtual machine to crash the virtual machine’s vmx process leading to a denial of service condition. CVE-2020-3958 Denial-of-service vulnerability in Shader functionality.VMware Horizon Clients for Windows, Mac, iOS, Linux, Chrome and Android allow you to connect to your VMware Horizon virtual desktop from your device of choice giving you on-the-go access from any location.

• CVE-2020-3957 Service opener – Time-of-check Time-of-use (TOCTOU) issueSuccessful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC, and Horizon Client are installed. Extract modules from the installer with command 'VMware-Horizon-Client-2106-8.3.0-.exe /X'.

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.A malicious actor with local non-administrative access to a virtual machine may be able to read privileged information contained in memory. Michael Gorelik, director of Morphisec, mentions that threat actors have tried to use this flaw to perform side-moving attacks on affected networks: “With privileged access, these types of attacks can easily evade typical defenses, including antivirus and endpoint detection and response,” he says.

Core Impact is a legitimate pentesting tool that can be abused for malicious purposes similar to Cobalt Strike.

The organizer then obtains the PowerTrash loader from the C&C server in a much obfuscated way to load a Core Impact agent into the memory of the affected system. The attack continues with the execution of a PowerShell command in Identity Manager, which is the vulnerable service.

Malicious hackers gain initial access to the target environment by exploiting CVE-2022-22954, the only one of the three flaws fixed by VMware that does not require administrative access to the affected server and for which there is a known PoC exploit.

Vmware horizon hackers are under exploit